Security Scan Report: www.bqzl36.vip

Redirected to:
https://www.frzbp6.vip:9001/register90672?i_code=99848766
Site favicon
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 4 countries across 4 domains to perform 39 HTTP transactions. The main domain is bqzl36.vip and was registered 2 months ago.

Submitted URL: https://www.bqzl36.vip

Effective URL:
https://www.frzbp6.vip:9001/register90672?i_code=99848766
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

10
Risk Score

Random .vip host redirecting to a second .vip signup page that claims Real Madrid/开云体育 official partnership and harvests hidden password fields, with a Formbook threat-intel match — brand-impersonation credential phishing.

Risk Factors (6)
Brand impersonation: claims official Real Madrid regional partnership and presents 开云体育 as its brand on an unrelated random .vip domain
Credential-collecting signup form with two password fields, both hidden from the visible page
Form data posted to a different registrable domain (frzbp6.vip) on port 9001 with an invitation/referral code parameter
Formbook malware threat-intelligence match associated with the entry domain (single-source, unverified)
Throwaway-style alphanumeric .vip hostnames across the redirect chain, unranked and without trustworthy reputation
Gambling-brand affiliate content typical of illegal betting portals
Domain age information unavailable

Details

Page Title

-皇家马德里足球俱乐部官方区域合作伙伴    开云体育官网

Scan Type

public

Domain Name Analysis

The domain name 'www.bqzl36.vip' uses the .vip top-level domain; it also runs on subdomain 'www'. Its registrable label 'bqzl36' stretches across 6 characters with zero vowels and four consonants, plus 2 digits. Word splitting yields 3 words: bq, zl, 36. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://www.bqzl36.vip

Page Load Overview

9.39s
Total Load Time
960 KB
Total Size

Language Analysis

Primary Language

🇨🇳Chinese
Code: zh
Confidence:60%
Script:Han
Direction:ltr

Detection Details

Text Length:126 chars
Detector Agreement:50%

Website Classification

Primary Category

real estate property97% confidence
Type: spa
Method: ml+structural+ocr_tiebreaker

All Detected Categories

real estate property
97%
finance banking
78%
adult content
67%
healthcare medical
60%
education learning
51%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
12172.65.218.116Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9154.220.10.112Seychelles
AS135097LUOGELANG (FRANCE) LIMITED
9103.41.81.248Hong Kong
AS153494XRUI TECHNOLOGY LIMITED
914.0.58.130Cdnetworks · CDNBangkok, Bangkok, Thailand
AS54994Meteverse Limited.
394--

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13AB21A334909B9730C363C9EE1F26A4E1908D219D56346C8F2ECF6EAD6DFF0A5D0A194

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:JjkD8Mr0wqtah6mpYZxMU76gGBtS6xNlM5KRZsVuSbxfcRBx2OcRBq3hcRO2Vb:JjkD8Mr0VmqdOTBtSknM5XVuA+m

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:24005:UXCIALxJOgyBiOqCZmCRA+1QBTlkUhxIgZwIgZiwVKBdHiCIGJMDCAwjRAYEABCdgCE0hwkAgOPpEAEYi3QYggG1pZQIIyUa

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffff1818180000
Perceptual Hash:cc88b326b69b99b2
Difference Hash:e8f0b2b2b2b2f0e0
Wavelet Hash:ffffff1818181800
Color Hash:#d279cc

Other Hashes

Crop Resistant:e8f0b2b2b2b2f0e0

Scan History

Scan history not available

Unable to load historical scan data